1. Field of the Invention
The present invention relates in general to a data processing system and, in particular, to a method, system, and computer program product for supporting multiple user credentials.
2. Description of the Related Art
Currently, whenever any user is logged into a multi-user or network environment, such as AIX or Windows, the loggin shell or environment allows for only one set of user credentials. That is, one user identification (ID), one primary group ID, and one or more secondary group IDs.
A problem arises when a user has more than one user account on a system, user1 and user2, for instance. The problem is that when the user is logged in under one account, user1, the user may only access a file if user1's credentials allow access, regardless of whether or not user2's credentials allow access to that file. Therefore, if a file has only been granted access for a user with user2's credentials, the user is not able to access that file while logged in as user1, even though user2 is also the user's account.
For example, on an AIX system, when a user, say aixuser1, is logged in, the logged in shell has only one user credential, one user ID, one primary group ID and one or more secondary group IDs. In the above example, the user has two user accounts, aixuser1 and aixuser2 and there are some files as follows:
-rw------- 1 aixuser1 staff 631365 June 14 13:56 peruser1.log
-rw------- 1 aixuser2 staff 631365 June 14 13:56 peruser2.log
-rw------- 1 aixuser3 staff 631365 June 14 13:56 peruser3.log
The user cannot access both the files that he has permission to use from a one user credential environment when logged in as aixuser1.
The same is true under a windows environment. When a user is logged in to a Windows environment, the logged environment has only one user credential and one or more group credentials based on the group memberships. The same example mentioned above for the AIX environment also applies to the Windows environment.
Presently, there are three ways to get around these restrictions, but none of these solutions is very satisfactory or efficient. One solution is to create a new group consisting of the two user IDs and set the file's group ID as the newly created group. However, this solution is not practical, because the user needs to be a system administrator to create groups or to change group memberships.
Another solution is to use access control lists (ACLs) to provide access to the second user ID. Every time user1 creates a new file, user1 needs to grant ACL access to user2 and vice-versa. However, a problem arises when the user's IDs change. For example, user2 gets assigned to another user and the user gets assigned a new user ID of user3. Now all the files and directories owned by user1 with ACL access to user2 need to be found and have the ACL access changed to user3 so that the files and directories owned by user1 are secured from user2. Additionally, files and directories that used to belong to user2 may also need to be found and altered.
Another solution is to login as user1, work with the files owned by user1, then logout and login as user2 and work with the files owned by user2. This solution is not very practical as all the files cannot be accessed from one login shell or environment.